SiYuan Publish Service Basic Auth Brute Force

Executive Summary

SiYuan versions before 3.7.4 have a brute-force vulnerability in the Publish Service Basic Auth. The Publish Service runs on a separate unauthenticated listener (default port 6808) and allows unlimited password guesses against named publish-viewer accounts without rate limiting or lockout mechanisms. Attackers can exploit this to gain unauthorized access to published notes or notebooks.

Useful 0 Not Useful 0

Detection Guidance

Check if the Publish Service is running on port 6808 by using commands like 'netstat -tulnp | grep 6808' or 'ss -tulnp | grep 6808'. Monitor authentication logs for repeated failed Basic Auth attempts against publish-viewer accounts. Use tools like 'hydra' or 'burp suite' to test for brute-force vulnerabilities on port 6808.

Useful 0 Not Useful 0

Impact Analysis

An attacker could gain unauthorized access to your published notes or notebooks by brute-forcing weak passwords. This could lead to exposure of sensitive information. The vulnerability also allows persistent session access and potential escalation to unauthorized tool calls.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. Organizations using affected SiYuan versions may face compliance breaches due to insufficient access controls and lack of rate limiting.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade SiYuan to version 3.7.4 or later to address the flaw. Disable the Publish Service if not needed by setting 'publish.enable' to false in configuration. Implement network-level restrictions to block external access to port 6808. Enforce strong passwords for publish-viewer accounts and monitor for suspicious login attempts.

Useful 0 Not Useful 0